Intelligent Electronic Devices (IEDs) are microprocessor-based devices used by the electric power industry to control power system switching devices, such as circuit breakers, reclosers, etc. With the standardization by the International Electrotechnical Commission (IEC) of the IEC 61850 process bus, most modern IEDs now support voltage and current inputs in a digital format, as Sampled Value (SV) streams transmitted as Ethernet packets on the process bus. In implementations according to the IEC61850-9-2 specifications, a merging unit (MU) is the device that samples the analog measurements (voltages and currents) of the primary high voltage power circuit, encodes the measurement values into Ethernet packets, and injects them onto the process bus. The IED receives these SV packets from the process bus, processes them, and uses the SV as the inputs to its various fault detection and protection functions.
More particularly, the IED processes the SV values with an internal Discrete Fourier Transform function to convert the SV streams into phasor values. The phasors are time-synchronized within an electrical power substation and can be published on the station bus, through Manufacturing Message Specification (MMS) reporting or according to the IEEE Standard for Synchrophasor Measurements for Power Systems (IEEE C37.1118-2011), for example. Phasor information can also be made available on the station bus through GOOSE (Generic Object Oriented Substation Events) messaging.
The IED thus operates on the basis of measured signals (e.g., voltages and currents, etc.) from attached sensors, signals from other IEDs indicating the state of their controlled elements, and signals from a supervisory system. The IED can also generate signals to act on its switching elements, to communicate its state to other IEDs or to inform the supervisory system. These signals are either hardwired or transmitted as network messages, for instance according to IEC 61850.
One key function of the IED is to detect that a fault happens on the primary circuit and to issue a “trip” command to activate a switching device and thus disconnect the faulty parts of the circuit. During this process, the analog inputs to the MUs and the resulting digitized SV packets are critical to the proper operation decision of the IEDs. Compared to earlier protection systems that relied on hardwired analog inputs, the use of digitized sample value streams and Ethernet technology opens the doors to cyber-attacks on the digitized sample value data. An attacker, once gaining access to the process bus or to a merging unit, can modify the SV packets received by the corresponding IED, and thus can manipulate the protection system and, potentially, cause serious consequences to the power grid. For example, a false trip on normally healthy circuits could cause the system to weaken in such a way that might lead to localized or regional grid collapse.
In addition to its primary protection function, an IED can include a control function for direct operation, whereby the IED executes commands from the operator, in particular to open and close assigned switching elements. An operator can initiate a control command from the Control Center (CC), the Station Human-Machine Interface (HMI), or the Local HMI on the front of the IED front. Alternatively, the command can also be executed by directly manipulating a protection device control data object in the IEC 61850 hierarchy, by gaining access to station bus.
Any of these operating channels, if accessed by an attacker, can potentially be used to issue a malicious control command to directly operate a station circuit breaker. This might lead to undesirable consequences if the control command is compromised during critical system operating conditions. Detection of such a malicious direct control command is difficult.
Accordingly, techniques and devices are needed for securing the IED system against cyber-attacks.